ShinyHunters defaces Clop's leak site and claims its onion keys — a cybercrime feud, and what's actually confirmed

Executive Summary

On the night of Friday, September 19, 2026, the extortion group ShinyHunters breached and defaced the Tor-based data leak site of the Clop (Cl0p) ransomware operation — one cybercrime brand publicly humiliating another.¹²³ BleepingComputer independently confirmed the two observable facts: an initial text file uploaded to Clop's server ("THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p — Maybe don't try to threaten us next time"), downloadable directly from Clop's onion site, and, hours later, the wholesale replacement of the leak site with ASCII art of Umbreon — the Pokémon ShinyHunters uses as its logo — above the line "rooting your systems since '19 ;)".¹

Everything beyond the defacement rests on ShinyHunters' own account. The group told BleepingComputer it exploited "what they claim is an unauthenticated file upload vulnerability in Grav CMS" to plant the file, then gained "full access" to the server and stole the leak site's source code, Grav CMS plugins, and system logs — including everything under /var/log, which it noted could contain authentication records and the IP addresses of visitors to Clop's site.¹ Most consequentially, ShinyHunters claims to have obtained the private keys to Clop's Tor onion service: "We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL."¹ If those keys are genuine, ShinyHunters could stand up a site at Clop's own onion address on infrastructure it controls. BleepingComputer states plainly that it has independently confirmed the defacement and the uploaded file but has not verified the claimed theft of source code, logs, or onion keys.¹

The motive is a cybercrime feud with a concrete origin. ShinyHunters says the attack is retaliation for threats made by a Clop representative during a dispute dating to Clop's 2025 Oracle E-Business Suite data-theft campaign — in which Clop exploited multiple Oracle EBS vulnerabilities, including the zero-day CVE-2025-61882, for mass extortion.¹ Around that campaign, actors calling themselves "Scattered Lapsus$ Hunters" (including ShinyHunters) leaked a proof-of-concept exploit that Oracle later confirmed matched the one used in the Clop attacks; ShinyHunters says the exploit was originally theirs and that Clop had taken it without authorization.¹ ShinyHunters alleges a Clop representative then messaged it directly with a death threat (translated from Russian: "I have more money than you and all of your people combined, I'll kill you soon").¹ ShinyHunters says it now intends to extort Clop, giving the gang 72 hours to make contact.¹

For a defensive publication, the value here is precisely in the gap between what is provable and what is asserted, by an actor whose entire business is making claims about data it holds. The defacement is real and independently confirmed; the data theft and the onion-key claim — the parts that would actually matter to Clop's victims and to Clop itself — are, so far, only ShinyHunters' word.

Verification of Claims

1. Claim: ShinyHunters defaced Clop's Tor leak site. → Verified → BleepingComputer independently confirmed both the initial uploaded file (downloadable from Clop's onion site) and the full defacement with ShinyHunters' Umbreon artwork.¹

2. Claim: ShinyHunters obtained the private keys to Clop's Tor onion service. → Unverified → This is ShinyHunters' claim; BleepingComputer states it has not independently verified it. If genuine, the keys would let ShinyHunters operate a site at Clop's existing onion address.¹

3. Claim: ShinyHunters stole Clop's leak-site source code and /var/log system logs. → Unverified → Also ShinyHunters' claim, explicitly not independently verified; only the defacement and uploaded file are confirmed.¹

4. Claim: The breach used an unauthenticated file-upload vulnerability in Grav CMS. → Weak evidence → BleepingComputer describes this as "what they claim." The compromise itself is proven by the confirmed defacement, but the specific entry vector is the attacker's account, uncorroborated.¹

5. Claim: The Umbreon defacement art ties this to ShinyHunters' earlier activity. → Assessed → Researcher VXDB told BleepingComputer the Umbreon artwork matches the August 2020 defacement of HackForums, which ShinyHunters also claimed at the time.¹

Timeline

Attack Anatomy

The only stage independently confirmed is the defacement; the access and theft steps are ShinyHunters' account, presented here as such.

Initial access — claimed Grav CMS file upload

ShinyHunters says it exploited an unauthenticated file upload vulnerability in Grav CMS — the flat-file content-management system running Clop's leak site — to upload a text file to the server (T1190).¹ BleepingComputer confirmed the file was present on Clop's server and downloadable from the onion site.¹

Escalation and control — claimed full server access

From that foothold, ShinyHunters claims it gained "full access" to the server (T1505.003), the level of control consistent with its ability to then replace the site entirely.¹

Data theft — claimed

ShinyHunters says it stole the leak site's source code, Grav CMS plugins, and all files under /var/log — potentially including authentication logs and visitor IP addresses (T1213) — and, critically, the private keys for Clop's Tor onion service (T1552.004).¹ None of this is independently verified.¹

Defacement and extortion — confirmed defacement

ShinyHunters replaced Clop's leak site with Umbreon ASCII art and a taunt (T1491.002), and stated it will publish a message on its own leak site giving Clop 72 hours to make contact before it acts on the stolen data (T1657).¹

Threat Actor Profile

• Attacker: ShinyHunters — a long-running data-theft and extortion group, self-identified in the defacement and in direct statements to BleepingComputer.¹ The "rooting your systems since '19 ;)" tagline and the reused Umbreon artwork (matching a 2020 HackForums defacement) are consistent with the group's history.¹
• Victim: the Clop (Cl0p) ransomware operation — itself a prolific extortion actor, most recently behind the October 2025 Oracle E-Business Suite mass-exploitation campaign.¹
• Motivation: retaliation and extortion. ShinyHunters frames the attack as payback for an alleged death threat from a Clop representative amid a dispute over ownership of the Oracle EBS exploit, and states it now intends to extort Clop.¹
• Attribution confidence: The attacker is self-identified and the defacement is confirmed, so ShinyHunters' authorship of the defacement is well supported. Its claims about what it stole are uncorroborated. Clop had not responded to BleepingComputer's request for comment at publication.¹

MITRE ATT&CK techniques (the entry vector and theft steps reflect ShinyHunters' claims; only the defacement is confirmed):

Technical Indicators

# This is a defacement-and-extortion incident against a criminal site; there is
# no defender-actionable malicious infrastructure to block. Artifacts are the
# attacker's own messaging and the claimed entry point.
victim: "Clop (Cl0p) ransomware data leak site (Tor onion service)"
software_named: "Grav CMS (flat-file CMS running the leak site)"
claimed_entry_vector: "unauthenticated file upload vulnerability in Grav CMS (attacker's claim)"
defacement_marker: "Umbreon ASCII art + 'rooting your systems since 19 ;)' (confirmed)"
uploaded_file_text: "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERES #Skids10p (confirmed on Clop server)"
claimed_stolen:
  - "leak site source code and Grav CMS plugins (unverified)"
  - "/var/log system logs, possibly incl. auth logs and visitor IPs (unverified)"
  - "Tor onion service private keys (unverified)"
network_iocs: none applicable
file_hashes: none disclosed

Legal and Regulatory Response

None. Both parties are criminal operations, and no law-enforcement action tied to this specific defacement has been reported. The broader backdrop includes Oracle's October 2025 confirmation that the leaked proof-of-concept matched the exploit (CVE-2025-61882) used in Clop's Oracle E-Business Suite campaign — the dispute ShinyHunters cites as the origin of the feud.¹

Impact Assessment

• Confirmed: Clop's Tor leak site was defaced by ShinyHunters; an initial taunt file was planted on Clop's server and was downloadable from the onion site.¹
• Claimed, unverified: Theft of the leak site's source code, Grav CMS plugins, /var/log logs (possibly including authentication data and visitor IP addresses), and the Tor onion service's private keys.¹
• Potential significance if the onion-key claim is true: ShinyHunters could host a site at Clop's existing onion address, undermining the integrity of Clop's leak-site brand and any victim negotiations conducted through it.¹
• Unknown: Whether Clop's operations, victim negotiations, or previously leaked victim data are affected; whether Clop can regain control; and whether ShinyHunters' data-theft claims hold up. Clop had not responded at publication.¹

Lessons and Defensive Recommendations

For threat intelligence and IR teams tracking these actors:

• Treat the defacement as confirmed and the data-theft/onion-key claims as unverified attacker assertions until corroborated. Extortion actors have a standing incentive to overstate what they hold; a leak-site takeover is highly visible, but "we have their onion keys and all their logs" is exactly the sort of claim that shapes rival-actor dynamics regardless of whether it is true.
• If ShinyHunters' /var/log claim were accurate, the most sensitive downstream exposure is not Clop's but that of visitors to Clop's leak site — journalists, researchers, victims, and negotiators whose connection metadata could sit in those logs. Assess that exposure independently of ShinyHunters' extortion narrative.

For defenders generally (the reusable technical lesson):

• The claimed entry vector is a mundane one: an unauthenticated file-upload flaw in a CMS. Whether or not it is the true vector here, unauthenticated file upload remains a top cause of web-server compromise. Enforce authentication on upload endpoints, validate file type and content server-side, store uploads outside the web root, and never trust a flat-file CMS deployment to be hardened by default.

For readers of cybercrime-on-cybercrime stories:

• Infighting between extortion brands is genuinely newsworthy, but the reporting standard should not drop just because the victim is itself a criminal group. The confirmed facts (a defacement) and the asserted ones (mass data and key theft) deserve to be labelled differently — which is how the original reporting handled it, and how any repetition of the story should too.

Sources